Sourced from dompurify's releases.

DOMPurify 3.2.6

• Fixed several typos and removed clutter from our documentation, thanks @​Rotzbua
• Added matrix: as an allowed URI scheme, thanks @​kleinesfilmroellchen
• Added better config hardening against prototype pollution, thanks @​EffectRenan
• Added better handling of attribute removal, thanks @​michalnieruchalski-tiugo
• Added better configuration for aggressive mXSS scrubbing behavior, thanks @​BryanValverdeU
• Removed the script that caused the fake entry CVE-2025-48050

DOMPurify 3.2.5

• Added a check to the mXSS detection regex to be more strict, thanks @​masatokinugawa
• Added ESM type imports in source, removes patch function, thanks @​donmccurdy
• Added script to verify various TypeScript configurations, thanks @​reduckted
• Added more modern browsers to the Karma launchers list
• Added Node 23.x to tested runtimes, removed Node 17.x
• Fixed the generation of source maps, thanks @​reduckted
• Fixed an unexpected behavior with ALLOWED_URI_REGEXP using the 'g' flag, thanks @​hhk-png
• Fixed a few typos in the README file

DOMPurify 3.2.4

• Fixed a conditional and config dependent mXSS-style bypass reported by @​nsysean
• Added a new feature to allow specific hook removal, thanks @​davecardwell
• Added purify.js and purify.min.js to exports, thanks @​Aetherinox
• Added better logic in case no window object is president, thanks @​yehuya
• Updated some dependencies called out by dependabot
• Updated license files etc to show the correct year

DOMPurify 3.2.3

• Fixed two conditional sanitizer bypasses discovered by @​parrot409 and @​Slonser
• Updated the attribute clobbering checks to prevent future bypasses, thanks @​parrot409

DOMPurify 3.2.2

• Fixed a possible bypass in case a rather specific config for custom elements is set, thanks @​yaniv-git
• Fixed several minor issues with the type definitions, thanks again @​reduckted
• Fixed a minor issue with the types reference for trusted types, thanks @​reduckted
• Fixed a minor problem with the template detection regex on some systems, thanks @​svdb99

DOMPurify 3.2.1

• Fixed several minor issues with the type definitions, thanks @​reduckted @​ghiscoding @​asamuzaK @​MiniDigger
• Fixed an issue with non-minified dist files and order of imports, thanks @​reduckted

DOMPurify 3.2.0

• Added type declarations, thanks @​reduckted , @​philmayfield, @​aloisklink, @​ssi02014 and others
• Fixed a minor issue with the handling of hooks, thanks @​kevin-mizu

DOMPurify 3.1.7

• Fixed an issue with comment detection and possible bypasses with specific config settings, thanks @​masatokinugawa
• Fixed several smaller typos in documentation and test & build files, thanks @​christianhg
• Added better support for Angular compiler, thanks @​jeroen1602
• Added several new attributes to HTML and SVG allow-list, thanks @​Gigabyte5671 and @​Rotzbua

... (truncated)

• 32f765e Merge pull request #1105 from cure53/main
• 6158ecb Merge pull request #1103 from cure53/main
• 0f7ce14 chore: Preparing 3.2.6 release
• 848463b chore: removed unused test server script
• b0e0ebb Update README.md
• f094f76 Update README.md
• 6bc6d60 Merge pull request #1101 from odaysec/patch-1
• e9afd60 Update server.js
• 166151c see #1095
• ac7c594 Merge pull request #1096 from Rotzbua/fix_missing
• Additional commits viewable in compare view

Sourced from hexo-renderer-marked's releases.

v7.0.1

Fixes

• fix: Maximum call stack size exceeded by @​D-Sketon in hexojs/hexo-renderer-marked#315

Performances

• perf: reduce the number of regexp calls by @​D-Sketon in hexojs/hexo-renderer-marked#317

Docs

• docs(renderer): remove link to oudated line by @​curbengh in hexojs/hexo-renderer-marked#312

New Contributors

• @​D-Sketon made their first contribution in hexojs/hexo-renderer-marked#315

Full Changelog: https://github.com/hexojs/hexo-renderer-marked/compare/v7.0.0...v7.0.1

v7.0.0

Breaking Changes

• chore: drop Node.js 16 by @​stevenjoezhang in hexojs/hexo-renderer-marked#307

Dependencies

• chore(deps): adapt to marked@12 by @​stevenjoezhang in hexojs/hexo-renderer-marked#280
• chore(deps-dev): bump c8 from 8.0.1 to 10.1.2 by @​dependabot in hexojs/hexo-renderer-marked#292
• chore(deps): bump jsdom from 20.0.3 to 25.0.1 by @​dependabot in hexojs/hexo-renderer-marked#296
• chore(deps): bump marked from 12.0.2 to 15.0.4 by @​dependabot in hexojs/hexo-renderer-marked#305
• chore(deps-dev): bump mocha from 10.8.2 to 11.0.1 by @​dependabot in hexojs/hexo-renderer-marked#309

CI/CD

• ci: bump actions/cache by @​SukkaW in hexojs/hexo-renderer-marked#295

Full Changelog: https://github.com/hexojs/hexo-renderer-marked/compare/v6.3.0...v7.0.0

v6.3.0

New Features

• Added filter marked:use for direct access to the marked.use function by @​crycode-de in hexojs/hexo-renderer-marked#273

Fixed

• fix: figcaption only works within figure by @​stevenjoezhang in hexojs/hexo-renderer-marked#279

Dependencies

• chore(deps): update devDependencies as possible by @​yoshinorin in hexojs/hexo-renderer-marked#274

... (truncated)

• 595814d release: v7.0.1 (#316)
• 830fce8 perf: reduce the number of regexp calls (#317)
• 0562dd7 docs(renderer): remove link to oudated line (#312)
• 4a57485 fix: Maximum call stack size exceeded (#315)
• 9d42f9e release: v7.0.0 (#308)
• 3214247 chore(deps-dev): bump mocha from 10.8.2 to 11.0.1 (#309)
• 7e5dde1 chore(deps): bump marked from 12.0.2 to 15.0.4 (#305)
• 6bdc070 chore(deps): bump jsdom from 20.0.3 to 25.0.1 (#296)
• ebcc9d6 chore: drop Node.js 16 (#307)
• b6b5b22 chore(deps-dev): bump c8 from 8.0.1 to 10.1.2 (#292)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.